[PATCH v2 2/3] AP: Always re-add stations that use MLO

[Rameshkumar Sundaram]

On 1/26/2026 9:33 PM, Benjamin Berg wrote:
> From: Benjamin Berg <benjamin.berg at intel.com>
> 
> When reauthenticating a STA MLD it might have a different set of links
> or may have changed its link address. In either case, should anything
> change then the STA needs to be reconfigured in the driver.
> 
> It is reasonable to simply always do this reconfiguration even if it is
> not needed in some corner cases.
> 
> Signed-off-by: Benjamin Berg <benjamin.berg at intel.com>
> Reviewed-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
> ---
>   src/ap/ieee802_11.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
> index 61a99cc293..a3dbeaf6b3 100644
> --- a/src/ap/ieee802_11.c
> +++ b/src/ap/ieee802_11.c
> @@ -3642,9 +3642,13 @@ static void handle_auth(struct hostapd_data *hapd,
>   	 *
>   	 * PASN authentication does not require adding/removing station to the
>   	 * driver so skip this flow in case of PASN authentication.
> +	 *
> +	 * Always re-add non-AP MLD stations to ensure only the authentication
> +	 * link is inserted with the correct address (which may have changed).
>   	 */
>   	if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
> -	    (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) &&
> +	    (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta) ||
> +	     mld_sta) &&

Doing this will reset the connection (and keys) of the existing 
authorized ML STA in the driver. A simple authentication frame received 
with the MLD address set to the existing authorized STA’s address could 
terminate the secured association.

Should we instead defer this until the association request is received, 
where SA‑Query validation can be performed? Or perhaps until the SAE 
exchange is completed, if the authentication algorithm is SAE?

>   	    !(hapd->conf->mesh & MESH_ENABLED) &&
>   	    !(sta->added_unassoc) && auth_alg != WLAN_AUTH_PASN) {
>   		if (ap_sta_re_add(hapd, sta) < 0) {


--
Ramesh